    csr-fn :- (schema/pred fn?)
    {:keys [ca-name capub cakey signeddir ca-ttl serial cert-inventory]} :- CaSettings]
   (let [csr         (utils/pem->csr (csr-fn))
-        [not-before
-         not-after] (cert-validity-dates ca-ttl)
+        validity    (cert-validity-dates ca-ttl)
         signed-cert (utils/sign-certificate (utils/cn ca-name)
                                             (utils/pem->private-key cakey)
                                             (next-serial-number! serial)
-                                            not-before
-                                            not-after
+                                            (:not-before validity)
+                                            (:not-after validity)
                                             (utils/cn subject)
                                             (utils/get-public-key csr)
                                             (create-agent-extensions

        public-key  (utils/get-public-key keypair)
        private-key (utils/get-private-key keypair)
        x500-name   (utils/cn (:ca-name ca-settings))
        [not-before
         not-after] (cert-validity-dates (:ca-ttl ca-settings))
        cacert      (utils/sign-certificate
                      x500-name
                      private-key
                      (next-serial-number! (:serial ca-settings))
                      not-before
                      not-after
                      x500-name
                      public-key)
        cacrl       (-> cacert

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;; Internal

(schema/defn cert-validity-dates :- {:not-before Date :not-after Date}
  "Calculate the not-before & not-after dates that define a certificate's
   period of validity. The value of `ca-ttl` is expected to be in seconds,
   and the dates will be based on the current time. Returns a map in the
   form {:not-before Date :not-after Date}."
  [ca-ttl :- schema/Int]
  (let [now        (time/now)
        not-before (time/minus now (time/days 1))
        not-after  (time/plus now (time/secs ca-ttl))]
    {:not-before (.toDate not-before)
     :not-after  (.toDate not-after)}))

(schema/defn settings->cadir-paths
  "Trim down the CA settings to include only paths to files and directories.
